Adversarial Logic

Every AI model, from a decision tree to a trillion-parameter language model, is vulnerable to the same six categories of attack, for a mathematical reason that doesn't go away no matter how good the model gets.

In March 2026, a poisoned LiteLLM release sat live on PyPI for 40 minutes; long enough to reach three million downloads. The publisher was trusted. The artifact was not. Most AI teams have a process for neither. This article provides one.

Perplexity filtering catches gibberish jailbreak suffixes almost perfectly. Then evolutionary jailbreaks started optimizing for low perplexity as part of the attack itself. Here's the full arc, with real numbers.

GCG's gibberish suffixes could jailbreak any LLM but needed model access and got caught by filters. Genetic algorithms fixed both problems: evolving human-readable jailbreak prompts that work black-box and read like normal text. Here's how AutoDAN, GPTFuzzer, and ASE do it.

Bird flocking, honeybee foraging, and evolutionary selection are now black-box attacks on neural networks. No gradients, no model access. All you need is an API and a query budget.